How to setup Multifactor Authentication for Intune Device Enrollment 

You can use Intune together with Azure Active Directory (Azure AD) conditional access policies to require multifactor authentication (MFA) during device enrollment. If you require MFA, employees and students wanting to enroll devices must first authenticate with a second device and two forms of credentials. MFA requires them to authenticate using two or more of these verification methods:
Something you know, such as a password or PIN.
Something you have that can't be duplicated, such as a trusted device or phone.
Something you are, such as a fingerprint.